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(54) Method and system for transferring funds and secure information between secure devices 



(57) Postal metering systems with an external com- 
munication link which allows funds to be transferred 
from one postal metering system to another. The exter- 
nal communication link is provided between the safe- 
keeping device of a first postal metering system to the 
secure communication device of a second postal meter- 
ing system so that funds can be transferred through the 
external communication link from the second metering 
system from its secure communication device to the 
safekeeping device of the first postal metering system. 
Furthermore, when the safekeeping device also stores 
secure information, secure information can be trans- 
ferred from the second metering system to the first me- 
tering system in the same manner. The safekeeping de- 
vice and the secure communication device are com- 
monly known as the postal secure device (PSD) and the 
gatekeeper. 
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Description 

[0001] The present invention relates generally to se- 
cure devices such as postal meters and, more particu- 
larly, to transferring funds or other information between 
security devices. 

[0002] Presently, there are two postal metering device 
types: a closed system and an open system. In a closed 
system, the system functionality is solely dedicated to 
metering activity. The closed-system metering devices 
are also referred to as postage-evidencing devices, 
which include conventional digital and analog (mechan- 
ical and electronic) postal meters, wherein a dedicated 
printer is securely coupled to a metering or accounting 
function. Furthermore, the printer is securely coupled 
and dedicated to the meter, and printing evidence of 
postage cannot take place without accounting for the ev- 
idence. In an open system, the printer is not dedicated 
to the metering activity, thereby freeing system function- 
ality for multiple and diverse uses in addition to the me- 
tering activity. Examples of open system metering de- 
vices include personal-computer (PC) based devices 
with single/multi-tasking operating systems, multi-user 
applications and digital printers. An open-system meter- 
ing device is a postage evidencing device with a non- 
dedicated printerthat is not securely coupled to a secure 
accounting module. An open-system indicium printed by 
the non-dedicated printer is made secure by including 
addressee information in the encrypted evidence of 
postage printed on the mailpiece for subsequent verifi- 
cation. See U.S. Patent Numbers 4,725,718 and 
4,831 ,555, each assigned to the assignee of the present 
invention. 

[0003] The United States Postal Service (USPS) has 
published draft specifications for IBIP (Information 
Based Indicia Program). These specifications define the 
proposed requirements for a Postal Security Device 
(PSD). A PSD is a secure processor-based accounting 
device that dispenses and accounts for postal value 
stored therein to support the creation of a new informa- 
tion-based postage postmark or indicium that will be ap- 
plied to a mailpiece being processed using IBIP. The 
IBIP Specifications define a stand-alone, open-metering 
system, referred to herein as a PC Meter. The PC Meter 
comprises a PSD coupled to a Host PC, which is a per- 
sonal computer (PC) operating as a host system with a 
printer coupled thereto. The Host PC runs the metering 
application and communicates with one or more at- 
tached PSD's. The PC Meter can only access PSD's 
coupled to the Host PC. There is no remote PSD access 
for the PC Meter. 

[0004] The PC Meter processes transactions for dis- 
pensing postage, registration and refills on the Host PC. 
Processing is performed locally between the Host PC 
and the PSD coupled thereto. Connections to a Data 
Center, for example, for registrations and refill transac- 
tions, are made locally from the Host PC through a local 
or network modem/internet connection. Accounting for 



debits and credits to the PSD is also performed locally, 
logging the transactions on the Host PC. The Host PC 
may accommodate more than one PSD, for example, 
supporting one PSD per serial port. 
5 [0005] One version of a network metering system, re- 
ferred to herein as a virtual postal metering system, has 
many Host PC's without any PSD's coupled thereto. The 
Host PC's run Host Applications, but all PSD functions 
are performed by server(s) located at a Data Center. 

10 The PSD functions at the Data Center may be per- 
formed in a secure device attached to a computer at the 
Data Center, or may be performed in the Data Center 
computer itself. The Host PC's must connect with the 
Data Center to process transactions such as postage 

15 dispensing, meter registration, or meter refills. Transac- 
tions are requested by the Host PC and are sent to the 
Data Center for remote processing. The transactions 
are processed centrally at the Data Center, and the re- 
sults are returned to the Host PC. Accounting for funds 

20 and transaction processing is centralized at the Data 
Center (See, for example, U.S. Patent Numbers 
4,873,645 and 5,454,038, which are assigned to the as- 
signee of the present invention). Typically, when a user 
makes a request via the Host PC to a Data Center for 

25 proof of postage payment for a mailpiece, the Host PC 
sends a group of standard mailing parameters, such as 
the user's full address and amount of postage request- 
ed, to the Data Center. After validating the user and the 
account balance, the Data Center uses the PSD to issue 

30 a digital signature/token based on the provided standard 
mailing parameters and sends the digital signature to 
the postal meter or printer so that the meter or the printer 
can print an indicium on the mailpiece as proof of post- 
age payment. 

35 [0006] In U.S. Patent Numbers 4,873,645 and 
5,454,038, a virtual postal metering system and method 
are disclosed, wherein the postal accounting and token 
generation occur at a data centerxemote from the post- 
age-evidencing printer. Although the Data Center may 

'40 be a secure facility, there remain certain inherent secu- 
rity issues since the accounting and token generation 
functions do not occur in a secure device local to the 
postage printer. The virtual postal metering system in- 
cludes a computer coupled to an unsecured printer and 

45 to a remote data metering system. The postal account- 
ing and the token generation occur at the Data Center. 
The Data Center is a centralized facility under the con- 
trol of a meter vendor, such as Pitney Bowes Inc., Stam- 
ford, Connecticut, USA or the Postat Service. As such, 

so it is regarded as secure compared to the environment 
where mailers handle meters directly. 
[0007] Presently, in a closed system, a postal meter 
is unidirectional in that the funds are loaded at the Data 
Center and the fund balance is deducted every time an 

55 indicium is printed. In an open system, the fund is stored 
in the PSD but it must be loaded through the Data Cent- 
er. In a sense, such an open metering system is also a 
unidirectional device. In a virtual postal metering system 
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as described above, the PSD functions are performed 
by servers at the Data Center. Thus, in prior art, the 
transfer of funds to a postal meter, regardless of the me- 
ter type, must be carried out through a Data Center to 
which the postal meter is operatively coupled, as shown 
in Figure 1. The prior art postal meter 1, as shown in 
Figure 1, comprises a user interface 10, a control logic 
unit 20, an input/output communication logic unit 30, a 
PSD 40, a gatekeeper 50 and a printing mechanism 60. 
The user interface 10 allows a customer to specify the 
postage amount of the indicium to be printed. The con- 
trol logic unit 20, upon receiving a signal from the user 
interface 10, notifies a PSD 40 of the specified postage 
amount. The PSD 40 checks to see whether the funds 
stored therein are sufficient to pay for the postage. If so, 
the PSD 40 sends a signal indicative of the indicium to 
the gatekeeper 50. When the user activates the postage 
meter 1 with a mailpiece on which the indicium is to be 
printed, a trip signal 82, via the control logic unit 20, 
causes the gatekeeper 50 to transfer the postage 
amount from the PSD 40 to the printing mechanism 60. 
Subsequently the requested indicium is printed. Where- 
as the PSD 40 keeps track of the funds stored in the 
postal meter 1 and authorizes a portion of the stored 
funds to be used for the postage indicium, the most im- 
portant function of the gatekeeper 50 is to maintain a 
secure connection between the PSD 40 and the printing 
mechanism 60. It should be noted that prior to the ad- 
vent of the digital postage meter, security in a mechan- 
ical meter was achieved by physically keeping the funds 
and printing within the same sealed box. Even after elec- 
tronic meters became available in the market, the con- 
cept of security remains substantially unchanged. How- 
ever, with digital postage meters, the funds and the print- 
ing are physically separated but connected by a cable. 
The cable must be secure so as to secure the funds in 
the digital postage meter. For that reason, the gatekeep- 
er is implemented in a postal meter, not only to control 
and generate functions related to indicium printing, but 
also to keep the communication between the printing 
mechanism and the PSD secure. The input/output com- 
munication logic unit 30 allows the transfer of funds be- 
tween a data center 80 and the postal'meter 1 . With the 
input/output communication logic unit 30, a customer 
uses the interface 10 to request the transfer of funds 
from the data center 80. The prior art system allows 
transfer of funds only between the data center and the 
postal meter 1 . 

[0008] Presently, it is not possible to transfer funds be- 
tween two postal metering systems even if these meter- 
ing systems are in the possession of the same individual 
or business entity. Thus, it is advantageous and desira- 
ble to provide a method and system for enabling one 
postal meter to transfer funds to another postal meter, 
or enabling one PSD to transfer funds or other informa- 
tion to others PSD's, 

[0009] It is an objective of the present invention to al- 
low a postal metering system to receive funds from an- 



other postal metering system, in addition to receiving 
funds from a data center. This objective can be achieved 
by providing an external communication link between 
two postal metering systems. 

5 [001 0] Accordingly, the first aspect of the present in- 
vention is a method of transferring funds between postal 
metering systems, wherein at least a first postal meter- 
ing system and a second postal metering system each 
comprises: a safekeeping device for storing and releas- 

10 ing funds; a secure communication device for ensuring 
that communications with the safekeeping device arie 
secure; an input/output communication module, opera- 
tively connected to the safekeeping device, to allow 
funds to be transferred from a data center to the safe- 

15 keeping device via the input/output communication 
module; and a control device, operatively connected to 
the secure communication device, for causing a release 
of funds by the safekeeping device through the secure 
communication device when the control device receives 

20 a request for said fund release. The method comprises 
the steps of; providing an external communication link 
from the first postal meterinjg system to the second post- 
al metering system; and transferring funds through the 
external communication linkfrom the second postal me- 

25 tering system from its secure communication device to 
the safekeeping device of the first postal metering sys- 
tem. 

[001 1] Advantageously, the fund transfer through the 
external communication link is in response to a request 

30 made at the control device of the first postal metering 
system. The method further comprises the steps of: 
sending a request of said fund transfer through the ex- 
ternal communication link, said request conveyed from 
the control device of the first postal metering system to 

35 the control device of the second postal metering system; 
and granting said request by the second postal metering 
system. 

[0012] Advantageously, the method further compris- 
es the steps of conveying a first signal from the control 

40 device of the second postal metering system to the con- 
trol device of the first postal metering system indicative 
of said granting; and conveying a second signal from 
the control device of the first postal metering system to 
the control device of the second postal metering system 

45 acknowledging receipt of the first signal, thereby caus- 
ing said fund transfer through the external communica- 
tion link. 

[001 3] Alternatively, the fund transfer through the ex- 
ternal communication link is in response to a request 

50 made at the control device of the second postal metering 
system, and the method further comprises the step of: 
conveying a first signal from the control device of the 
second postal metering system to the control device of 
the first postal metering system notifying said fund trans- 

55 fer through the external communication link; and con- 
veying a second signal from the Control device of the 
first postal metering system to the control device of the 
second postal metering system acknowledging receipt 
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of the first signal, thereby causing said fund transfer 
through the external communication link. 
[0014] Advantageously, the external communication 
link comprises a wireless communication link. 
[0015] Advantageously, the postal metering systems 
fu rther comprises at least a third metering system, which 
includes a safekeeping device for storing and releasing 
funds; and a secure communication device for ensuring 
that communications with the safekeeping device are 
secure. The method further comprises the steps of: pro- 
viding a further external communication link from the 
second postal metering device to the third metering sys- 
tem; and transferring funds through the further external 
communication linkfrom the second postal metering de- 
vice from its secure communication device to the safe- 
keeping device of the third metering system. 
[0016] Advantageously, the safekeeping device also 
stores secure information and the control device is ca- 
pable of causing a release of information by the safe- 
keeping device through the secure communication de- 
vice through the external communication link. 
[0017] The second aspect of the present invention is 
a postal metering system comprising: a safekeeping de- 
vice for storing and releasing funds; a secure commu- 
nication device for ensuring that communications with 
the safekeeping device are secure; an input/output com- 
munication module, operatively connected to the safe- 
keeping device, to allow funds to be transferred from a 
data center to the safekeeping device via the input/out- 
put communication module; and a control device, oper- 
atively connected to the secure communication device, 
for causing the safekeeping device to release funds 
through the secure communication device when the 
control device receives a request for said fund release, 
wherein the safekeeping device further comprises an 
external communication link so as to allow the postal 
metering system to receive funds from another postal 
metering system via the secure communication device 
thereof through the external communication link. 
[0018] The third aspect of the present invention is a 
secure system, which comprises: a safekeeping device 
for storing and releasing secure informiation; a secure 
communication device for insuring communications with 
the safekeeping device are secure; an input/output com- 
munication module, operatively connected to the safe- 
keeping device, to allow secure information to be trans- 
ferred from a data center to the safekeeping device; and 
a control device, operatively connected to the secure 
communication device, for causing a release of secure 
information by the safekeeping device through the se- 
cure communication device upon receiving a request for 
said fund release, wherein the safekeeping device fur- 
ther comprises an external communication link so as to 
allow the secure system to receive secure information 
from another secure system via the secure communica- 
tion device thereof through the external communication 
link. 

[0019] The present invention will become apparent 



upon reading the description taken in conjunction with 
Figures 2 to 7. 

[0020] Figure 1 is a block diagram showing a prior art 
postal meter connected to a Data Center for transferring 
5 funds therebetween. 

[0021] Figure 2 is a block diagram showing a pre- 
ferred postal meter system, according to the present in- 
vention. 

[0022] Figure 3a is a block diagram showing the con- 
10 nection between two postal metering systems, accord- 
ing to the present invention, for transferring funds from 
one system to another. 

[0023] Figure 3b is a block diagram showing the con- 
nections between two postal metering systems for 
15 transferring funds in a different fashion. 

[0024] Figure 4 is a block diagram showing a wire con- 
nection among a plurality of postal metering systems, 
according to the present invention. 
[0025] Figure 5 is a flowchart illustrating the method 
20 of secure fund transfer between a donor meter and a 
recipient meter, according to the present invention. 
[0026] Figure 6 is a block diagram showing the con- 
nection between two hand-held postal meters, accord- 
ing to the present invention, for transferring funds. 
25 [0027] Figure 7 is a block diagram showing a gener- 
alized secure system for transferring secure informa- 
tion, according to the present invention. 
[0028] For illustration purposes, the present invention 
is described in conjunction with a postal metering sys- 
30 tern, as shown in Figures 2-6. However, the present in- 
vention is applicable to any secure device, as shown in 
Figure 7. 

[0029] Typically, the postal meter 100, according to 
the present invention, can be used to print postage in- 
35 dicia (not shown) to be used on mailpieces. As with the 
prior art postal meter 1, printing indicia upon request is 
a normal function of the meter 100. As shown in Figure 
2, the postal meter 100 comprises a user interface 110, 
a control logic unit 120, an input/output communication 
40 logic unit 130, a postal secure device (PSD) 140, a gate- 
keeper 150 and a printing mechanism 160. As with the 
prior art postal meter 1, the postal meter 100 can be 
linked to a data center 180 for transferring funds there- 
between via the input/output communication logic unit 
45 1 30. In contrast to the prior art postal meter 1, the control 
logic unit 120, the PSD 140 and the gatekeeper 150 are 
capable of communicating with other postal meters 100, 
via communication lines 184, 142 and 152, respectively. 
The signal line 182 is used to provide a trip signal when 
50 a customer activates the postal meter 100 by a mail- 
piece on which the requested indicium is printed. 
[0030] The gatekeeper 150, according to the present 
invention, is operatively connected between the PSD 
140 and the printing mechanism 160 so as to maintain 
55 a secure connection therebetween regarding the print- 
ing of postage indicia. In addition, the gatekeeper 150 
maintains a secure connection between the PSD 140 
and an external device. More specifically, when the 
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postal meter 100 is required to transfer funds out of the 
postal meter 100 to another postal meter, the gatekeep- 
er 150 maintains a secure connection between the PSD 
140 of the postal meter 100 and the PSD of the other 
postal meter, as shown in Figure 3a. 5 
[0031] Figure 3a shows the connection between a 
postal meter 100 a and a postal meter 100 b in a system 
200 so as to allow the postal meter 1 00 a to transfer funds 
to the postal meter 100 b . In this case, the postal meter 
100 a is the donor meter and the postal meter 100 b is the 10 
recipient meter. For example, when a customer enters 
a request 210 through the user interface 110 b of the 
postal meter 1 00 b , the control logic unit 120 h determines 
whether the request 210 is for the normal function of in- 
dicium printing, or for the additional function of fund 15 
transfer. If it is a printing request, the postal meter 100 b 
carries out its normal function of indicium printing as de- 
scribed in conjunction with the prior art meter 1. If the 
request 210 is for transferring funds from postal meter 
100 a to postal meter 110 b> the control logic unit 120 b 20 
sends a signal 186 via the signal line 1 84 b to the control 
logic unit 120 a requesting such a fund transfer. Upon 
receiving the fund transfer request 1 86 via the signal line 
164 a , the control logic unit 120 a notifies the PSD 140 a 
of such request. The PSD 140 a checks to se$ whether 25 
there are sufficient funds stored therein for such a trans- 
fer and whether the funds transfer is authorized. Sub- 
sequently, the PSD 140 a sends a signal 144 indicative 
of the transferred funds to the gatekeeper 150 a . At the 
same time, the control logic 1 20 a notifies the control log- so 
ic 120 b with a signal 188 that the request is granted. The 
control logic 120 b notifies the PSD 14p b that the re- 
quested funds are now available, and sends an ac- 
knowledgment signal 190 to the control logic 120 a . Sim- 
ilar to the trip signal 1 82 a , which causes the gatekeeper 35 
150 a to transfer the postage amount from the PSD140 a 
to the printing mechanism 160 a , the signal 190 causes 
the gatekeeper 150 a to transfer the funds 154 from the 
PSD 140 a to the PSD 140 b . Accordingly, the PSD 140 b 
stores the received funds 154 in the postal meter 100 b 40 
and the PSD 140 a reduces the stored funds therein. 
[0032] Using a similar connection, the customer of the 
postal meter 100 b can also authorize a funds transfer 
from the postal meter 100 b to the postal meter 100 a by 
inputting a command 212 using the user interface 11 0 b , 45 
as shown in Figure 3b. In this case, the control logic unit 
120 b notifies the PSD 140 b and the control logic unit 
120 a of such transfer. Upon receiving the signal 192, the 
control logic unit 120 a notifies the PSD 140 a of the forth- 
coming event. Subsequently, the control logic 120 a no- so 
tifies the control logic 120 b via a signal 1 94 that the post- 
al meter 100 a is ready to receive the transferred funds. 
The signal 194 causes the gatekeeper 150 b to release 
the authorized funds 156 from the PSD 140 b to the PSD 

140 a , 55 

[0033] Wireless connection among a number of post- 
al meters 100 is shown In Figure 4. In the system 300, 
as shown in Figure 4, a donor meter 100 d is adapted to 



receive funds from the data center 180 and acts as a 
distributor of funds to one or more postal meters 1 00 1 
100 n . Each of the postal meters 100 d , 100 1 ,..., 100 n 
comprises a transceiver 170, operatively connected to 
its control logic unit 120, PSD 140 and gatekeeper 150 
so that it can communicate with other postal meters in 
a wireless fashion. Using the arrangement as shown in 
Figure 4, the bulk of the funds can be stored in one vault 
in one meter to be distributed to other meters upon re- 
quest. As shown, the funds are stored in the vault 172 
in the donor postal meter 100 d . Funds can then be 
downloaded to any of the recipient postal meters 
100 1v ..., 100 n , in smaller amounts, from the donor postal 
meter 100 d . When funds are downloaded to a recipient 
postal meter 1 00 n from the donor postal meter 1 00 d , se- 
cure communication of funds is carried out from the 
gatekeeper 150 of the donor to the PSD 150 of the re- 
cipient, in a procedure similar to that described in con- 
junction with Figure 3a. Advantageously, not all the post- 
al meters need to store a large fund. Thus, the total 
amount of funds required for all postal meters is sub- 
stantially reduced. As such, fund control and manage- 
ment can be improved. In the arrangement, as illustrat- 
ed in Figure 4, only one analog link (between the data 
center 1 80 and the donor postal meter 1 00 d ) is required. 
This reduces the number of multiple analog lines nec- 
essary for the postal meters to communicate with the 
data center. 

[0034] In the arrangement as shown in Figures 3a and 
3b, any meter unit may act as donor or recipient. In the 
arrangement shown in Figure 3a, the unit making the 
request can be referred to as the recipient unit or RU 
and the other unit can be referred to as donor unit or 
DU, An exemplary sequence for making a funds transfer 
request is summarized as follows: 
[0035] 1 . User enters amount to be transferred to the 
RU. 

[0036] 2. User hits a request key. 
[0037] 3 The DU checks to make sure it has sufficient 
funds to transfer. If it does not have sufficient funds, it 
sends back a "not. sufficient fund" signal and the opera- 
tion is terminated. Otherwise the fund transfer is initiat- 
ed. When the transfer is completed, the RU displays a 
"transaction completed". 

[0038] In this sequence, the operation is initiated at 
the RU by the user using the user interface, The signal 
input through the user interface is detected by the con- 
trol logic, which checks through the RU gatekeeper for 
funds from the DU PSD. The DU PSD sends a granted 
or not granted signal to the RU through the DU control 
logic unit via the request line. If granted, the RU sends 
an acceptance signal via its user interface, control logic 
to the DU control logic, which notifies the DU PSD of the 
acceptance. Finally, the DU PSD sends funds through 
DU gatekeeper to RD PSD. All the activities described 
above involve the control logic units of both meters. 
[0039] The connection between two postal meters 
100 a and 100 b , as shown in Figures 3a and 3b, can be 
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wired or wireless. For example, the postal meters 100 a 
and 100 b can be operatively connected to each other 
via a router or a server (not shown) in a local network of 
the Internet environment. Similarly, the postal meters 
100 a and 100 b can be connected to each other via mo- 
dems (not shown). Thus, the present invention is appln 
cable to stand-alone systems as well as systems con- 
nected to the Internet or any communications network. 
Furthermore, the present invention uses the device 
known as Meter PSD as well as the infrastructure for 
remote funds and information downloading. 
[0040] In the fund transfer process between a donor 
" meter and a recipient, as described in conjunction with 
Figure 3a, in particular, the process involves essentially 
three stages: 1) The recipient meter makes a request 
for fund transfer thereto; 2) the donor meter grants or 
denies the request, based on whether it has sufficient 
funds and whether the transfer is authorized, for exam- 
. pie; and 3) the recipient accepts the granting or cancels 
the request, due to the request amount being entered 
erroneously, for example. Accordingly, the process can 
be illustrated in the flowchart as shown in Figure 5. As 
shown, the process 400 comprises a standby mode at 
step 410 in which the donor meter does nothing but 
waits for a request to be initiated by a recipient meter, 
at step 420. The request can be represented by the sig- 
nal 186 in Figure 3a, for example. In response to the 
request, the donor meter checks to see whether it has 
sufficient funds to transfer and whether the requesting 
meter is authorized for such a transfer. If the answers 
are in the affirmative, the donor meter grants request of 
the recipient at step 430, and the process continues at 
step 440. Otherwise, the transaction is terminated and 
the process loops back to the standby mode 410. The 
granting message from the donor meter to the recipient 
meter can be represented by the signal 188 in Figure 
3a ( for example. Upon receiving the granting message, 
the recipient meter has a choice to continue the process 
by accepting the funds to be transferred by the donor 
meter or to cancel the transaction. If the recipient meter 
decides to continue the process, it sends an acceptance 
signal to the donor meter. The acceptance signal can 
be represented by the signal 190 of Figure 3a, for ex- 
ample. Subsequently, the donor meter, at step 450, 
transfers the request funds from its gatekeeper to the 
PSD of the recipient meter, as indicated by signal 154 
of Figure 3a. The transaction is now completed and the 
process loops back to the standby mode at step 410. 
[0041] The method of fund transfers between postal 
meters 100, according to the present invention, is appli- 
cable to a hand-held metering unit 100' (without a print- 
ing mechanism) whether the hand-held metering unit is 
linked to a regular postal meter 100 (with a printing 
mechanism) or another hand-held metering unit 100\ 
Figure 6 illustrates the connection between two hand- 
held metering units 100'. Either metering unit 100' can 
be a recipient while the other can be the donor. For ex- 
ample, if the metering unit 100*a is the donor, then funds 



154*a can be transferred from the gatekeeper 150'a to 
the PSD 140'b. Likewise, if the metering unit 100'b is 
the donor, the funds 154*b can be transferred from the 
gatekeeper 1 50'b to the PSD 140a 1 . Either metering unit 
5 can be linked to the data center 180 for fund transfer 
between the data center and the requesting metering 
unit. 

[0042] it should be noted that the postal meter 100, 
as illustrated in Figure 2, is only a special embodiment 
10 of the secure device of the present invention. A gener- 
alized secure device, according to the present invention, 
is shown in Figure 7. In a postal meter 100, the general 
function of the PSD 140 is to dispense and account for 
postal value stored therein to pay forthe postage indicia, 
15 In that respect, the PSD 140 is a safekeeping module. 
The general function of the gatekeeper 150 is to secure 
the communication between the PSD 140 and the print- 
ing mechanism 160 of the same postal meter 100 or the 
PSD 140 of a recipient postal meter 1 00. The gatekeep^ 
20 er 150 can be referred to as a secure communication 
module. Likewise, the printing mechanism 160 is a type 
of output device. Thus, instead of having a PSD 140, a 
gatekeeper 150 and a printing mechanism 1 60, the gen- 
eralized secure device 100", as shown in Figure 7, com- 
25 pnses a safekeeping module 140", a secure communi- 
cation module 150" and an output device 160". In addi- 
tion to transferring funds, the secure device 100" can 
also be used to transfer secure information. Analogous 
to the printing mechanism 160 in a postal meter 1 00, the 
30 output device 160" can be used to display secure infor- 
mation upon receiving a request made by a customer 
using the user interface 110". Secure information can 
be transferred from the safekeeping module 140" 
through the secure communication module 150" of 
35 a "donor" secure device 100" to the safekeeping mod- 
ule 140" of a "recipient" secure device 100". The trans- 
action between a "donor" secure device 100" and 
a "recipient" secure device 100" is similar to the trans- 
action between a donor meter 100 and a recipient meter 
40 1 00 as described in conjunction with Figure 3a. The 
method of secure transaction, as illustrated in Figure 5, 
is also applicable to the secure device 100" if the 
term "fund" in blocks 440 and 450 of flowchart 400 is 
replaced by "secure information". 
45 [0043] Thus, although the invention has been de- 
scribed with respect to a preferred embodiment thereof, 
it will be understood by those skilled in the art that the 
foregoing and various other changes, omission and de- 
viations in the form and detail thereof may be made with- 
50 out departing from the scope of this invention. 



Claims 

55 1 . A method of transferring funds between postal me- 
tering systems, wherein at least a first postal meter- 
ing system and a second postal metering system 
each comprises: 
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a safekeeping device for storing and releasing 
funds; 

a secure communication device for ensuring 
that communications with the safekeeping de- 
vice are secure; 5 
an input/output communication module, opera- 
tively connected to the safekeeping device, to 
allow funds to be transferred from a data center 
to the safekeeping device via the input/output 
communication module; and 10 
a control device, operatively connected to the 
secure communication device, for causing a re- 
lease of funds by the safekeeping device 
through the secure communication device 
when the control device receives a request for *5 
said fund release, said method comprising the 
step of: 

providing an external communication link 
from the first postal metering system to the 20 
second postal metering system: and 
transferring funds through the external 
communication link from the second postal 
metering system from its secure communi- 
cation device to the safekeeping device of 25 
the first postal metering system. 

The method of claim 1, wherein said fund transfer 
through the external communication link is in re- 
sponse to a request made at the control device of 30 
the first postal metering system. 

The method of claim 2. further comprising the steps 
of : 

35 

sending a request of said fund transfer through 
the external communication link, said request 
conveyed from the control device of the first 
postal metering system to the control device of 
the second postal metering system; and 40 
granting said request by the second postal me- 
tering system. 

The method of claim 3, further comprising the steps 

of: 45 

conveying a first signal from the control device 
of the second postal metering system to the 
control device of the first postal metering sys- 
tem indicative of said granting; and so 
conveying a second signal from the control de- 
vice of the first postal metering system to the 
control device of the second postal metering 
system acknowledging receipt of the first sig- 
nal, thereby causing said fund transfer through 55 
the external communication link. 

The method of claim 1, wherein said fund transfer 



through the external communication link is in re- 
sponse to a request made at the control device of 
the second postal metering system. 

6. The method of claim 5, further comprising the steps 
of: 

conveying a first signal from the control device 
of the second postal metering system to the 
control device of the first postal metering sys- 
tem notifying said fund transfer through the ex- 
ternal communication link; and 
conveying a second signal from the control de- 
vice of the first postal metering system to the 
control device of the second postal metering 
system acknowledging receipt of the first sig- 
nal, thereby causing said fund transfer through 
the external communication link. 

7. The method of claim 1, wherein the external com- 
munication link comprises a wireless communica- 
tion link. 

8. The method of claim 1 , wherein the postal metering 
systems further comprises at least a" third metering 
system, which comprises: 

a safekeeping device for storing and releasing 
funds; and 

a secure communication device for ensuring 
that communications with the safekeeping de- 
vice are secure, said method further comprising 
the steps of: 

providing a further external communication 
link from the second postal metering de- 
vice to the third metering system; and 
transferring funds through the further ex- 
ternal communication link from the second 
postal metering device from its secure 
communication device to the safekeeping 
device of the third metering system. 

9. The method of claim 8, wherein the further external 
communication link comprises a wireless commu- 
nication link. 

10. The method of claim 1, wherein the safekeeping de- 
vice also stores secure information and the control 
device is capable of causing a release of informa- 
tion by the safekeeping device through the secure 
communication device through the external com- 
munication link. 

11. A postal metering system comprising: 

a safekeeping device for storing and releasing 
funds; 
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a secure communication device for ensuring 
that communications with the safekeeping de- 
vice are secure; 

an input/output communication module, opera- 
tively connected to the safekeeping device, to 5 
allow funds to be transferred from a data center 
to the safekeeping device via the input/output 
communication module; and 
a control device, operatiyely connected to the 
secure communication device, for causing the 10 
safekeeping device to release funds through 
the secure communication device when the 
control device receives a request for said fund 
release, wherein the safekeeping device fur- 
ther comprises an external communication link 15 
so as to allow the postal metering system to re- 
ceive funds from another postal metering sys- 
tem via the secure communication device 
thereof through the external communication 
link. 20 

A secure system comprising: 

a safekeeping device for storing and releasing 
secure information; 25 
a secure communication device for insuring 
communications with the safekeeping device 
are secure; 

an input/output communication module, opera- 
tively connected to the safekeeping device, to 30 
allow secure information to be transferred from 
a data center to the safekeeping device; and 
a control device, operatively connected to the 
secure communication device, for causing a re- 
lease of secure information by the safekeeping 35 
device through the secure communication de- 
vice upon receiving a request for said fund re- 
lease, wherein the safekeeping device further 
comprises an external communication link so 
as to allow the secure system to receive secure 40 
information from another secure system via the 
secure communication device thereof through 
the external communication link. 

45 
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